test+ci: 51 frontend unit-тестов (Vitest) + CI rollback на single resolve-tag

Tests (Vitest):
- src/lib/dates.ts (вынесено из SchemaDrivenForm + dictionaries.$name): parseFormDate,
  formatIsoDate, formatIsoDateTime, extractTime, combineDateTime, localTzOffset, nowIsoLocal
- src/lib/dates.test.ts (20 tests): TZ-safety, pure-date local midnight, far-future filter,
  round-trip parse/format, time extraction в local TZ, clear-button (null Date → '')
- src/components/schema/types.test.ts (31 tests): buildSchemaJson всех 9 kinds + x-unique +
  x-id-source, parseSchemaJson roundtrip, diffSchemas (8 breaking detection cases),
  suggestVersionBump (major/minor/patch + breaking-wins-mix)

CI:
- Откатил dual resolve-tag (BACKEND/FRONTEND) на single resolve-tag.
  GitLab variable interpolation в trigger jobs не подхватывает dotenv от needs-job
  → admin-ui-only push не доезжал до infra. Now backwards compat path работает
  как раньше с UPSTREAM_IMAGE_TAG.
- Backend docker jobs (maven-package + 4 docker-*) теперь без rules:changes —
  catch ImagePullBackOff если frontend push шёл без backend rebuild. BuildKit cache
  делает повторный билд идентичных layers ~30 sec.
- Path-filter оставлен на maven-test (тесты не запускаются на frontend-only PR
  — они бэкендовые) и на docker-admin-ui (frontend-only).

Run: pnpm test → 51 passed.

.gitlab-ci.yml

@@ -69,6 +69,10 @@ maven-test:
     - changes: *backend-changes
 
 # ─── BUILD (Maven jars) ────────────────────────
+# maven-package всегда запускается: docker backend jobs нуждаются в jar даже
+# при frontend-only PR (иначе backend образы не пересобрать → ImagePullBackOff
+# в кластере при rolling update). BuildKit layer cache делает повторную сборку
+# идентичных jar'ов ~30 sec.
 maven-package:
   stage: build
   image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
@@ -79,8 +83,6 @@ maven-package:
       - "**/target/*.jar"
       - ordinis-migrations/src/main/resources/db/changelog/**
     expire_in: 1 day
-  rules:
-    - changes: *backend-changes
 
 # ─── PUBLISH (Docker images) ───────────────────
 .docker_base:
@@ -116,8 +118,6 @@ docker-app:
     BUILD_CONTEXT: .
   script:
     - *publish_script
-  rules:
-    - changes: *backend-changes
 
 docker-read-api:
   extends: .docker_base
@@ -128,8 +128,6 @@ docker-read-api:
     BUILD_CONTEXT: .
   script:
     - *publish_script
-  rules:
-    - changes: *backend-changes
 
 docker-projection-writer:
   extends: .docker_base
@@ -140,8 +138,6 @@ docker-projection-writer:
     BUILD_CONTEXT: .
   script:
     - *publish_script
-  rules:
-    - changes: *backend-changes
 
 docker-migrations:
   extends: .docker_base
@@ -152,8 +148,6 @@ docker-migrations:
     BUILD_CONTEXT: ordinis-migrations/
   script:
     - *publish_script
-  rules:
-    - changes: *backend-changes
 
 docker-admin-ui:
   extends: .docker_base
@@ -168,83 +162,45 @@ docker-admin-ui:
     - changes: *frontend-changes
 
 # ─── TRIGGER DEPLOY ───────────────────────────
-# Два resolve job'а: один на backend, другой на frontend. Каждый бьётся в dotenv,
-# trigger downstream получает обе переменные (или одну, если изменения в одной зоне).
-# infra применяет --set <svc>.tag=$X только для тех сервисов где tag непустой.
+# Single resolve-tag (always runs) → один UPSTREAM_IMAGE_TAG. Path-filter
+# работает на уровне docker-* jobs (backend skip если бэк не менялся,
+# layers cache hit делает rebuild ~30 sec). Полное per-service splitting
+# через dual dotenv не работает с GitLab trigger var interpolation.
 
-resolve-backend-tag:
+resolve-tag:
   stage: trigger-deploy
   image: repo.nstart.cloud/library/alpine:3.20
-  needs: [maven-package]
   script:
-    - echo "BACKEND_IMAGE_TAG=$IMAGE_TAG" > backend.env
-    - cat backend.env
+    - echo "RESOLVED_IMAGE_TAG=$IMAGE_TAG" > resolved.env
+    - cat resolved.env
   artifacts:
     reports:
-      dotenv: backend.env
+      dotenv: resolved.env
   rules:
-    - changes: *backend-changes
-
-resolve-frontend-tag:
-  stage: trigger-deploy
-  image: repo.nstart.cloud/library/alpine:3.20
-  needs: [docker-admin-ui]
-  script:
-    - echo "FRONTEND_IMAGE_TAG=$IMAGE_TAG" > frontend.env
-    - cat frontend.env
-  artifacts:
-    reports:
-      dotenv: frontend.env
-  rules:
-    - changes: *frontend-changes
+    - if: '$CI_COMMIT_BRANCH == "main"'
 
 trigger-deploy-staging:
   stage: trigger-deploy
-  needs:
-    - job: resolve-backend-tag
-      optional: true
-    - job: resolve-frontend-tag
-      optional: true
+  needs: [resolve-tag]
   trigger:
     project: 2-6/2-6-4/terravault/ordinis-infra
     branch: main
     strategy: depend
   variables:
-    BACKEND_IMAGE_TAG: $BACKEND_IMAGE_TAG
-    FRONTEND_IMAGE_TAG: $FRONTEND_IMAGE_TAG
+    UPSTREAM_IMAGE_TAG: $RESOLVED_IMAGE_TAG
     DEPLOY_ENV: staging
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
-      changes:
-        - "ordinis-app/**/*"
-        - "ordinis-read-api/**/*"
-        - "ordinis-projection-writer/**/*"
-        - "ordinis-rest-api/**/*"
-        - "ordinis-domain/**/*"
-        - "ordinis-validation/**/*"
-        - "ordinis-events-api/**/*"
-        - "ordinis-outbox/**/*"
-        - "ordinis-auth/**/*"
-        - "ordinis-cuod-bundle/**/*"
-        - "ordinis-migrations/**/*"
-        - "ordinis-admin-ui/**/*"
-        - "pom.xml"
-        - ".gitlab-ci.yml"
 
 trigger-deploy-prod:
   stage: trigger-deploy
-  needs:
-    - job: resolve-backend-tag
-      optional: true
-    - job: resolve-frontend-tag
-      optional: true
+  needs: [resolve-tag]
   trigger:
     project: 2-6/2-6-4/terravault/ordinis-infra
     branch: main
     strategy: depend
   variables:
-    BACKEND_IMAGE_TAG: $BACKEND_IMAGE_TAG
-    FRONTEND_IMAGE_TAG: $FRONTEND_IMAGE_TAG
+    UPSTREAM_IMAGE_TAG: $RESOLVED_IMAGE_TAG
     DEPLOY_ENV: prod
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'